# How to Create Login failed Rule

**URL:** https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862
**Category:** Kibana
**Created:** [October 28, 2021, 12:59am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862 "2021-10-28T00:59:13Z")
**Posts on this page:** 4
**Page:** 1

<div class="post-metadata">

### Author: ![Renz\_Aguilar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renz_aguilar/32/86215_2.png) [@Renz\_Aguilar](https://discuss.elastic.co/u/Renz_Aguilar)
#### Post date: [October 28, 2021, 12:59am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862/1 "2021-10-28T00:59:13Z")

</div>

Hi Team can i ask how to create a login failed rule on kibana? i want to monitor the users who failed logging in into their computer.

 ![1](https://us1.discourse-cdn.com/elastic/original/3X/6/9/69a65cacdbadf61d24e837aaf26e47075b6919ae.png)

---

<div class="post-metadata">

### Author: ![cheiligers](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cheiligers/32/73114_2.png) [@cheiligers](https://discuss.elastic.co/u/cheiligers)
#### Post date: [October 29, 2021, 11:28pm UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862/2 "2021-10-29T23:28:25Z")

</div>

Hi @Renz_Aguilar and welcome to the community!  
It sounds like you want to know how to configure [Audit Logging](https://www.elastic.co/guide/en/kibana/current/xpack-security-audit-logging.html#_category_authentication) in Kibana that will allow you to record and monitor failed authorization attempts.  
The docs describe the step-by-step process to get setup, after which you should be able to create the rule as shown in the screenshot.  
I'm not sure what version of Kibana you're running or your subscription level. The link to the docs are for the 7.15 version and Audit logging requires a subscription (paid license).

---

<div class="post-metadata">

### Author: ![Renz\_Aguilar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/renz_aguilar/32/86215_2.png) [@Renz\_Aguilar](https://discuss.elastic.co/u/Renz_Aguilar)
#### Post date: [November 25, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862/3 "2021-11-25T01:46:22Z")

</div>

![image](https://us1.discourse-cdn.com/elastic/original/3X/b/e/bee64242aeda78691569e206235e640262d5a447.png)  
Hi i want to collect the user login failure of the users, these are my rule settings but still i cant get failed login logs, please help thank you.

---

<div class="post-metadata">

### Author: ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)
#### Post date: [December 23, 2021, 1:46am UTC](https://discuss.elastic.co/t/how-to-create-login-failed-rule/287862/4 "2021-12-23T01:46:26Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.